🚨 Under Attack

Contain the Threat

Goal: Stop the attack from spreading

If You Suspect Malware/Ransomware

1. Isolate infected device - Disconnect from network immediately
2. Identify patient zero - Which device was infected first?
3. Check other devices - Scan all devices on network for infection
4. Disable network shares - Prevent ransomware from spreading to shared drives
5. Check backups - Are they encrypted too? When was last clean backup?

If Account Was Compromised

1. Change password immediately - From a different, clean device
2. Enable 2FA - If not already enabled
3. Check email forwarding rules - Attackers hide here to maintain access
4. Review recent activity - Login history, sent emails, file access
5. Revoke app permissions - Remove third-party app access
6. Check recovery options - Verify recovery email/phone haven't been changed

If Financial Account Compromised

1. Call bank immediately - Freeze accounts and cards
2. Dispute fraudulent charges - File disputes for unauthorized transactions
3. Place fraud alert - Contact credit bureaus (Experian, Equifax, TransUnion)
4. Monitor credit reports - Check for new accounts opened in your name
5. File police report - Required for identity theft affidavit

Secure All Accounts

Goal: Lock down everything before attacker can do more damage

Change All Passwords (Priority Order)

1. Email accounts - Master key to everything else
2. Password manager - If compromised, everything is at risk
3. Banking and financial - Credit cards, PayPal, Venmo, crypto exchanges
4. Work accounts - Email, Slack, VPN, cloud storage
5. Social media - Facebook, Instagram, Twitter, LinkedIn
6. Cloud storage - Google Drive, Dropbox, iCloud, OneDrive
7. Shopping accounts - Amazon, eBay, etc. (saved payment methods)

Enable 2FA Everywhere

• Use authenticator app (Authy, Google Authenticator), not SMS
• Save backup codes in password manager
• Consider hardware security keys (YubiKey) for critical accounts

Review Account Security

• Check login history - Look for unfamiliar locations or devices
• Review connected apps - Revoke third-party access you don't recognize
• Update recovery options - Verify recovery email and phone number
• Enable login alerts - Get notified of new sign-ins

Recover and Clean Up

Goal: Remove the threat and restore normal operations

If Malware/Ransomware

1. Don't pay ransom - No guarantee of decryption, funds terrorism
2. Check for decryption tools - Visit nomoreransom.org for free decryptors
3. Wipe and reinstall - Nuclear option but safest for infected devices
4. Restore from backup - Use clean backup from before infection
5. Scan all devices - Use multiple antivirus tools to verify clean

If Account Compromise

1. Document everything - Screenshots, timestamps, suspicious activity
2. Contact support - Report compromise to platform (Google, Microsoft, etc.)
3. Request account review - Have platform check for backdoors
4. Monitor for 30+ days - Watch for signs attacker maintained access

If Financial Fraud

1. File identity theft report - IdentityTheft.gov
2. Place credit freeze - All three bureaus (free)
3. Monitor credit reports - AnnualCreditReport.com (free)
4. Consider credit monitoring - Paid service for ongoing protection
5. Update all financial accounts - New account numbers, cards

Prevent Future Attacks

Goal: Build defenses so this never happens again

Immediate Improvements

• Password manager - Unique passwords for every account
• 2FA everywhere - Especially email and financial accounts
• Automatic backups - 3-2-1 rule (3 copies, 2 media types, 1 offsite)
• Software updates - Enable automatic updates on all devices
• Antivirus/EDR - Real-time protection on all computers

Long-Term Security Strategy

• Complete First Steps Defense - Master the fundamentals
• Network-level protection - Pi-hole, router hardening (Home Fortress)
• Advanced monitoring - Network traffic analysis (Power User Defense)
• Regular security audits - Monthly check-ins on accounts and devices
• Stay informed - Follow security news, learn from others' mistakes